LLM-based vulnerability detectors are increasingly deployed in security-critical code review, yet their resilience to evasion under behavior-preserving edits remains poorly understood. We evaluate detection-time integrity under a semantics-preserving threat model by instantiating diverse behavior-preserving code transformations on a unified C/C++ benchmark (N=5000), and introduce a metric of joint robustness across different attack methods/carriers. Across models, we observe a systemic failure of semantic invariant adversarial transformations: even state-of-the-art vulnerability detectors perform well on clean inputs while predictions flip under behavior-equivalent edits. Universal adversarial strings optimized on a single surrogate model remain effective when transferred to black-box APIs, and gradient access can further amplify evasion success. These results show that even high-performing detectors are vulnerable to low-cost, semantics-preserving evasion. Our carrier-based metrics provide practical diagnostics for evaluating LLM-based code detectors.
Recurrent models are frequently being used in online tasks such as autonomous driving, and a comprehensive study of their vulnerability is called for. Existing research is limited in generality only addressing application-specific vulnerability or making implausible assumptions such as the knowledge of future input. In this paper, we present a general attack framework for online tasks incorporating the unique constraints of the online setting different from offline tasks. Our framework is versatile in that it covers time-varying adversarial objectives and various optimization constraints, allo…
Automated Vulnerability Injection in Smart Contracts Using Large Language Models
Università degli Studi di Napoli Federico II（那不勒斯费德里科二世大学）；Gran Sasso Science Institute (GSSI)（格兰萨索科学研究所）；University of Coimbra（科英布拉大学）；College of Computing and Informatics, University of North Carolina at Charlotte（北卡罗来纳大学夏洛特分校计算与信息学院）
Accidental Vulnerability: Factors in Fine-Tuning that Shift Model Safeguards
University of Toronto（多伦多大学）；Vector Institute（向量研究所）；ETH Zürich（苏黎世联邦理工学院）；FAR AI（FAR人工智能公司）；McGill University（麦吉尔大学）；MILA（蒙特利尔人工智能研究院）；Max Planck Institute for Intelligent Systems, Tübingen, Germany（图宾根德国智能系统研究所）
CLNX: Bridging Code and Natural Language for C/C++ Vulnerability-Contributing Commits Identification
School of Cyber Science and Engineering, Huazhong University of Science and Technology（华中科技大学网络空间科学与工程学院）；Hubei Key Laboratory of Distributed System Security（湖北省分布式系统安全重点实验室）；Hubei Engineering Research Center on Big Data Security（湖北省大数据安全工程研究中心）
Blind PRNG Hijacking: An Undetectable Integrity-Preserving Attack Against LLM Watermarking
Fujian Provincial Key Laboratory of Automotive Electronics and Electric Drive（福建省汽车电子与电力驱动重点实验室）；School of Electronic, Electrical and Physics（电子、电气与物理学院）；Fujian University of Technology（福建理工大学）；School of Humanities（人文学院）；Institute of Applied Physics and Materials Engineering（应用物理与材料工程学院）；University of Macau（澳门大学）
CGP-Tuning: Structure-Aware Soft Prompt Tuning for Code Vulnerability Detection
School of Computer Science and Engineering, University of New South Wales (UNSW)（新南威尔士大学计算机科学与工程学院）；Department of Electrical Engineering and Information Technology, University of Naples Federico II（那不勒斯费德里克二世大学电气工程与信息技术系）
Penn State University（宾夕法尼亚州立大学）；Pusan National University（釜山国立大学）；Fudan University（复旦大学）
As an increasing number of deep-learning-based malware scanners have been proposed, the existing evasion techniques, including code obfuscation and polymorphic malware, are found to be less effective. In this work, we propose a reinforcement learning-based semantics-preserving (i.e.functionality-preserving) attack against black-box GNNs (GraphNeural Networks) for malware detection. The key factor of adversarial malware generation via semantic Nops insertion is to select the appropriate semanticNopsand their corresponding basic blocks. The proposed attack uses reinforcement learning to automati…
Intelligent code analysis has received increasing attention in parallel with the remarkable advances in the field of machine learning (ML) in recent years. A major challenge in leveraging ML for this purpose is to represent source code in a useful form that ML algorithms can accept as input. In this study, we present a novel method to represent source code as image while preserving semantic and syntactic properties, which paves the way for leveraging computer vision techniques to use for code analysis. Indeed the method makes it possible to directly enter the resulting image representation of …
